Notice of Privacy Practices

1. Purpose

The Indiana University School of Dentistry follows the privacy practices described in this Notice. For purposes of this Notice, the Indiana University School of Dentistry is defined as all professional staff, employees, trainees and volunteers who perform services at a number of treatment sites including the Indiana University School of Dentistry Predoctoral, Graduate, Dental Hygiene, Research, and Dental Faculty Practice Clinics as well as University Hospital Dental Clinics, Oral Health Research Institute, Walker Plaza, Seal Indiana: IUSD Mobile Sealant Program (hereinafter IUSD). IUSD maintains your health information in records that will be maintained in a confidential manner, as required by law. However, IUSD must use and disclose your health information to the extent necessary to provide you with quality health care. To do this, IUSD must share your health information as necessary for treatment, payment and health care operations. This Notice will remain in effect until we replace it. The terms of this Notice may change at any time.

IUSD may use or disclose your health information for the following purposes:

• Those involved in your care or payment: family members or close friends involved in your treatment.
• Business associates: We contract with outside organizations, called business associates, to perform some of our operational tasks on our behalf. Examples would include billing agencies or a copy service we use when making copies of your health record. When these services are performed, we disclose the necessary health information to these companies. To protect your health information, however, we require the business associate to appropriately safeguard your information.
• Disaster relief agency, if you are involved in a disaster relief effort.
• Appointment reminders (such as voicemail messages, emails, text, postcards, or letters).
• Marketing: To inform you of possible treatment alternatives, benefits or services related to your health. (You will have an opportunity to refuse to receive this information.) IUSD must obtain an authorization from you for certain uses and disclosures of your information for marketing. IUSD will not sell your information for any purpose without your authorization.
• As required by law: we will disclose your health information when we are required to do so by federal, state or local law.
• Public health activities: including disease prevention, injury, or disability; reporting births and deaths; reporting child abuse or neglect; reporting reactions to medications or product problems; notification of recalls; infectious disease control; notifying government authorities of suspected abuse, neglect, or domestic violence.
• Health oversight activities such as audits, inspections, investigations, and licensure.
• Lawsuits and disputes: we may disclose information about you in response to a court or administrative order. We may also disclose information about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute.
• Law enforcement: for example, in response to a court order or other legal process; to identify or locate an individual being sought by authorities; about the victim of a crime under restricted circumstances; about a death that may be the result of criminal conduct; about criminal conduct that occurred on IUSD premises; and in emergency circumstances relating to reporting information about a crime.
• Coroners, medical examiners, and funeral directors.
• Organ and tissue donation.
• To perform research projects: IUSD performs medical and dental research. IUSD may disclose your protected health information to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure, among other things, the privacy of your protected health information. IUSD may release information about you to researchers who need to know how many patients have a specific health issue in preparation for proposed research. If a provider caring for you believes you may be interested in, or may benefit from, a research study, IUSD or the research review committee will designate someone to contact you. This individual will see if you are interested in the study, provide you with more information and give you the opportunity to participate or to decline further contact.
• To prevent a serious threat to health or safety.
• Military command authorities if you are a member of the armed forces or a member of a foreign military authority.
• National security and intelligence activities, including protection of the president or other authorized persons for foreign heads of state, or to conduct special investigations.
• Inmates. Health information about inmates of correctional institutions may be released to the institution.
• Workers’ compensation. Your health information regarding benefits for work-related illnesses may be released as appropriate.
• Health exchanges: IUSD may participate in certain health information exchanges or organizations. In particular, IUSD may participate in the Indiana Health Information Exchange (IHIE), Indiana Network for Primary Care (INPC), and Regenstrief Institute, Inc., which help to make your protected health information available to other health care providers who may need access to it in order to provide care or treatment to you. At any time, you may change your mind about agreeing to release information to these programs/exchanges by giving notice to IUSD in writing of your decision; however, any information that has been released prior to IUSD receiving your written notice cannot be retrieved.
• Fundraising: IUSD may use necessary protected health information to contact you in an effort to raise money for its operations (fundraising). We may disclose protected health information to a foundation related to IUSD so that it may contact you to raise money to support IUSD, unless you tell us not to contact you for this purpose. If you do not want IUSD to contact you for fundraising, then you may request that IUSD not contact you by informing the privacy officer at the address or phone number listed below.

You have the following rights regarding your health information, provided that you make a written request to invoke the right on the form provided by IUSD:

• Right to request restriction. You may request limitations on your health information we use or disclose for health care treatment, payment, or operations (e.g., you may ask us not to disclose that you have had a particular surgery), but we are not required to agree to your request. If we agree, we will comply with your request unless the information is needed to provide you with emergency treatment. You may request a restriction on the form provided by IUSD. The request should be filed by using the contact information at the end of this Notice.
• Right to confidential communications. You may request communications in a certain way or at a certain location, but you must specify how or where you wish to be contacted. You may request confidential handling of information on the form provided by IUSD. The request should be filed using the contact information at the end of this Notice.
• Right to inspect and copy. You have the right to inspect and copy your health information regarding decisions about your care, including mental health notes; however, mental health records may be withheld if the health care provider determines, in their best judgment, that the information requested is detrimental to the physical and mental health of the patient, or likely to cause the patient to harm himself or another person. Upon written request and reasonable notice, you may request access and/or copies by using the contact information at the end of this Notice. We may charge a fee for copying, mailing, and supplies. Under limited circumstances, your request may be denied; you may request review of the denial by another licensed health care professional chosen by IUSD. IUSD will comply with the outcome of the review.
• Right to request amendment. If you believe that the health information we have about you is incorrect or incomplete, you may request an amendment on the form provided by IUSD, which requires certain specific information. The request should be filed using the contact information at the end of this Notice. IUSD is not required to accept the amendment.
• Right to accounting of disclosures. You may request a list of the disclosures of your health information that have been made to persons or entities other than for health care treatment, payment, or operations in the past six (6) years, but not prior to April 14, 2003. After the first request in a 12-month period, there may be a charge. You may request an accounting of disclosures on the form provided by IUSD. The request should be filed using the contact information at the end of this Notice.
• Right to a copy of this Notice. You may request a paper copy of this Notice at any time, even if you have been provided with an electronic copy. You may obtain an electronic copy of this Notice at our website.
• Right to restrict disclosure to a third-party payer. If you pay in full for the services provided to you at IUSD, you can require that the information regarding the service not be disclosed to a third-party payer since no claim is being made against the third-party payer.
• Right to be notified after a breach of unsecured protected health information. Should IUSD experience a breach of your protected health information which was unsecured, you will be provided notice thereof.

Other uses and disclosures of health information not covered by this notice or the laws that apply to us will be made only with your written permission. If you provide us permission to use or disclose health information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose health information about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission and that we are required to retain our records of the care that we provided to you.